Independent, vendor-neutral due diligence for your material service provider arrangements. CYBORIUM helps APRA-regulated banks, insurers and superannuation licensees evaluate, select and monitor third parties — without commercial bias.
APRA’s Prudential Standard CPS 230 Operational Risk Management came into effect on 1 July 2025. It sets out how APRA-regulated entities must manage operational risk, maintain business continuity, and — the pillar most relevant to third-party spend — oversee the management of service provider arrangements.
Under CPS 230, a material service provider is any third party your entity relies on to undertake a critical operation, or one that exposes it to material operational risk. For each of these arrangements the standard expects comprehensive due diligence before onboarding, ongoing monitoring, a maintained register, and credible contingency and exit plans. Good CPS 230 third-party risk management is now a board-level accountability, not a procurement afterthought.
CPS 230 consolidates and replaces the former CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management). The practical challenge for most entities is evidence: demonstrating that a provider was selected and is monitored on a defensible, arm’s-length basis. That is exactly where an independent evaluator adds value. Read our deeper explainer on how CPS 230 and CPS 234 are reshaping vendor selection in Australia, or review our independent evaluation methodology.
Six obligations sit at the centre of the service provider management pillar. Each one needs evidence an auditor and APRA can follow.
Maintain a register of material service providers and be able to provide it to APRA on request — kept current as arrangements change.
Comprehensive assessment before entering into, or materially changing, an arrangement — covering capability, resilience and risk.
Continuous oversight of performance, control effectiveness and risk profile across the life of each material arrangement.
Identify and manage over-reliance on single providers and the sub-contractors (fourth parties) sitting behind them.
Credible, tested plans to substitute or exit a provider without unacceptable disruption to critical operations.
Notify APRA of material arrangements and material risk events, under a service provider management policy approved by the board.
CPS 230 applies across the APRA-regulated population. If your organisation holds an APRA licence, the service provider obligations apply to your critical third parties.
Timing note: CPS 230 has applied since 1 July 2025. For service provider arrangements in place before that date, APRA’s transitional relief generally allowed compliance by the earlier of the next contract renewal or 1 July 2026. Confirm your entity’s specific obligations with APRA guidance and your own advisers.
CYBORIUM is a vendor-neutral evaluator. We don’t resell technology or earn referral fees, so our assessment of a material service provider reflects fit and risk — the arm’s-length evidence CPS 230 expects.
CYBORIUM provides independent sourcing and evaluation support. It does not provide legal or regulatory advice, and does not certify compliance. Your entity remains responsible for meeting its own CPS 230 obligations.
Four steps that turn CPS 230 obligations into repeatable, evidenced practice.
Map critical operations and set the criteria that make a provider “material” for your entity.
Assess capability, operational resilience, security and financial standing — on the evidence.
Rank options against objective criteria, exposing concentration and fourth-party exposure.
You contract directly with the chosen provider, with a reassessment cadence to keep the register current.
The dimensions that determine whether a third party can be relied on for a critical operation.
Continuity capability, recovery objectives and the provider’s own dependency chain under stress.
Security posture and control maturity, aligned to APRA CPS 234 expectations for information assets.
Financial standing and going-concern signals that speak to a provider’s durability.
Single-supplier reliance and the sub-contractors sitting behind a material provider.
Offshoring, jurisdiction and data-location risk relevant to Australian regulated data.
How readily the provider can be replaced, and how clean an exit path would be.
You end up with documented, arm’s-length evidence for every material service provider decision — the kind of trail that stands up to a board, an auditor and APRA.
Start a CPS 230 conversationCPS 230 is about demonstrable, objective judgement. A reseller earning margin on the provider they recommend can’t offer that. CYBORIUM can — we take no vendor commissions, resell nothing, and have no stake in which provider you choose. Explore our guided vendor evaluations or our framework for enterprise vendor selection.
Talk to an independent evaluator about your material service provider arrangements — no products, no commissions, no bias.